The safest ransomware strategy is not EDR or backup; it is EDR and backup, tested together. EDR helps stop or contain an attack before it spreads. Backups help you recover when prevention fails. If you treat either one as enough on its own, you are leaving a gap attackers can use.
TLDR: Use EDR to detect ransomware behavior early, isolate infected endpoints, and slow the attacker down. Use immutable, tested backups to restore systems without paying. For example, a 120 person accounting firm with EDR and clean backups may isolate 6 infected laptops in minutes and restore 2 file servers from the previous night, losing hours of work instead of weeks. Without backups, even a 95 percent detection rate can still leave you exposed to the one attack that gets through.
EDR vs Backup: What Each One Actually Does
Endpoint Detection and Response, or EDR, watches laptops, desktops, and servers for suspicious activity. It looks for signs such as mass file changes, credential theft, unusual PowerShell use, privilege escalation, and connections to known malicious sites. Good EDR can trigger alerts, block processes, quarantine files, and isolate a device from the network.
Backup is different. It does not stop ransomware from starting. It gives your business a way back. A proper backup system stores clean copies of files, databases, virtual machines, and configuration data. The best designs include immutable storage, offline copies, encryption, strict access controls, and regular restore testing.
Think of EDR as the guard at the door and inside the building. Think of backup as the fire exit, insurance file, and rebuild plan. You need both because ransomware is not just malware anymore. It is often a human led intrusion that includes stolen passwords, remote access tools, data theft, and planned destruction.
What EDR Does Well
EDR is valuable because it can catch behavior that traditional antivirus misses. That matters because many ransomware groups now avoid obvious malware at first. They use legitimate tools, stolen admin accounts, and remote management software already trusted in the environment.
Strong EDR can help with:
- Early detection: It can flag suspicious scripts, credential dumping, and lateral movement before encryption starts.
- Fast containment: Security teams can isolate a compromised endpoint to stop spread across shared drives and servers.
- Incident evidence: Logs show what ran, which user was involved, what files changed, and where the attack moved next.
- Automated response: Some tools can kill malicious processes and block known attack patterns without waiting for a human.
The catch is that EDR can be noisy. Teams may get hundreds of alerts a day. Some are serious. Many are not. It drives people mad when an urgent ransomware signal is buried under routine software update noise. If no one is watching the console, or if alerts are tuned badly, the tool becomes expensive decoration.
Where EDR Falls Short
EDR is not magic. Attackers test against common security tools. They also try to disable agents, steal admin credentials, abuse trusted tools, or strike systems that are not covered. Servers get missed. Contractors bring unmanaged laptops. Old machines keep running because “no one wants to touch them.” That is where trouble starts.
EDR is also weaker after an attacker gains high level access. If a domain admin account is stolen, the attacker may push changes across the network, tamper with security settings, or delete logs. A mature security team can still respond, but the margin for error shrinks fast.
Most of all, EDR does not guarantee recovery. It may tell you exactly what happened and still leave you with encrypted files. That is useful, but it does not reopen your order system, payroll platform, or patient records by itself.
What Backups Do Well
Backups are the last line of defense when ransomware succeeds. They reduce panic. They give leaders options. They can also remove the pressure to pay criminals, which is one of the most valuable outcomes of all.
A ransomware ready backup plan should include:
- Immutable backups: Copies that cannot be changed or deleted during the retention period.
- Offline or logically separated copies: Storage that ransomware cannot reach through normal network access.
- Multiple restore points: More than one recovery date, since attackers may sit inside systems for days or weeks.
- Role based access: Backup admins should not use the same accounts as domain admins.
- Restore testing: A backup is only real if it restores cleanly and within the required time.
Backups also support forensic work. You can compare clean and infected versions of systems. You can rebuild from a known good state. You can restore critical services first, such as identity systems, finance platforms, and file shares.
Where Backups Fall Short
Backups fail more often than leaders expect. Sometimes the backup job has been failing for two months and no one noticed. Sometimes the data restores, but the application will not start. Sometimes the restore speed is painfully slow. Honestly, it feels like the worst time to discover a database restore takes 11 hours longer than planned is while executives are asking for updates every 20 minutes.
Attackers also target backups. They look for backup consoles, storage keys, management servers, and cloud credentials. If backup access is tied to the same identity system that was compromised, the attacker may delete or encrypt recovery copies before launching ransomware.
Backups also do not stop data theft. Many ransomware groups now steal files before encryption. Even if you restore every server, you may still face legal, regulatory, and reputational damage if sensitive data is leaked.
Which One Matters More?
If forced to choose, backups are usually the more critical survival control. Without clean backups, recovery may depend on paying criminals, rebuilding from scratch, or accepting permanent data loss. None of those are good options.
But that does not make EDR optional. Backup without EDR can mean repeated reinfection. You restore systems, then the same attacker uses the same stolen account to encrypt them again. EDR helps identify the entry point, contain active threats, and confirm when it is safe to recover.
The better question is not “Which tool wins?” The better question is “How do they work together during a real incident?”
How EDR and Backup Should Work Together
A credible ransomware defense uses EDR and backup in a coordinated process:
- Detect: EDR flags suspicious encryption, credential abuse, or lateral movement.
- Contain: Security staff isolate affected endpoints and block malicious activity.
- Assess: Teams identify patient zero, compromised accounts, changed files, and impacted systems.
- Preserve: Logs, memory captures, and disk images are retained where needed for investigation.
- Eradicate: Malware, persistence methods, backdoors, and stolen credentials are removed.
- Restore: Clean backups are used to recover systems in business priority order.
- Validate: EDR monitors restored systems for signs of reinfection.
This sequence matters. Restoring too early can waste time and spread infection. Waiting too long can increase downtime. A written runbook helps teams make better decisions under stress.
Practical Steps to Reduce Ransomware Risk
Start with coverage. Every server and endpoint that can access business data should be protected. Unknown devices should not have quiet access to file shares.
Harden identity. Use multi factor authentication, remove stale accounts, limit admin rights, and monitor privileged logins. Many ransomware incidents start with stolen credentials, not exotic malware.
Protect backups like production systems. Use separate admin accounts, separate authentication, immutable storage, and alerts for deletion attempts. Keep at least one copy outside the reach of normal domain credentials.
Test restores often. Do not only test one small file. Test full server recovery, database recovery, and application recovery. Track recovery time and recovery point results. If the business needs a four hour recovery time, prove it before an incident.
Practice the incident plan. Include security, IT, legal, communications, leadership, and key vendors. Decide who can shut down systems, who calls insurance, and who approves public statements.
Final Recommendation
Use EDR to reduce the chance of a successful ransomware attack. Use backups to reduce the damage when one still happens. EDR gives visibility and containment. Backup gives resilience and recovery. Together, they turn ransomware from a business ending crisis into a controlled, if still painful, incident.
The serious approach is simple: monitor aggressively, restrict access, keep immutable backups, and test recovery under real conditions. If you cannot detect fast and restore clean, you are not ready.